lkml.org 
[lkml]   [2018]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.16 13/48] ipv4: remove warning in ip_recv_error
    Date
    4.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Willem de Bruijn <willemb@google.com>

    [ Upstream commit 730c54d59403658a62af6517338fa8d4922c1b28 ]

    A precondition check in ip_recv_error triggered on an otherwise benign
    race. Remove the warning.

    The warning triggers when passing an ipv6 socket to this ipv4 error
    handling function. RaceFuzzer was able to trigger it due to a race
    in setsockopt IPV6_ADDRFORM.

    ---
    CPU0
    do_ipv6_setsockopt
    sk->sk_socket->ops = &inet_dgram_ops;

    ---
    CPU1
    sk->sk_prot->recvmsg
    udp_recvmsg
    ip_recv_error
    WARN_ON_ONCE(sk->sk_family == AF_INET6);

    ---
    CPU0
    do_ipv6_setsockopt
    sk->sk_family = PF_INET;

    This socket option converts a v6 socket that is connected to a v4 peer
    to an v4 socket. It updates the socket on the fly, changing fields in
    sk as well as other structs. This is inherently non-atomic. It races
    with the lockless udp_recvmsg path.

    No other code makes an assumption that these fields are updated
    atomically. It is benign here, too, as ip_recv_error cares only about
    the protocol of the skbs enqueued on the error queue, for which
    sk_family is not a precise predictor (thanks to another isue with
    IPV6_ADDRFORM).

    Link: http://lkml.kernel.org/r/20180518120826.GA19515@dragonet.kaist.ac.kr
    Fixes: 7ce875e5ecb8 ("ipv4: warn once on passing AF_INET6 socket to ip_recv_error")
    Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/ip_sockglue.c | 2 --
    1 file changed, 2 deletions(-)

    --- a/net/ipv4/ip_sockglue.c
    +++ b/net/ipv4/ip_sockglue.c
    @@ -511,8 +511,6 @@ int ip_recv_error(struct sock *sk, struc
    int err;
    int copied;

    - WARN_ON_ONCE(sk->sk_family == AF_INET6);
    -
    err = -EAGAIN;
    skb = sock_dequeue_err_skb(sk);
    if (!skb)

    \
     
     \ /
      Last update: 2018-06-09 17:32    [W:4.115 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site